PT-2026-30663 · Openexr · Openexr

Quangio · Publicado 2026-04-06 · Atualizado 2026-06-01 · CVE-2026-34589

Positive Technologies (AI Summary) · Pt

CVSS v4.0

8.4

Alta

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenEXR versões 3.2.0 através de 3.2.6, 3.3.9 e 3.4.9

Description OpenEXR, um formato de armazenamento de imagem usado na indústria cinematográfica, contém uma falha no decodificador DWA lossy. Especificamente, o decodificador usa aritmética de 32 bits com sinal para criar ponteiros de bloco temporários, o que pode causar estouro para larguras de imagem grandes. Esse estouro leva a gravações fora dos limites na memória fora do bloco de linha alocado, o que pode levar a travamentos ou outros comportamentos inesperados.

Recommendations Atualize para a versão OpenEXR 3.2.7 ou posterior. Atualize para a versão OpenEXR 3.3.9 ou posterior. Atualize para a versão OpenEXR 3.4.9 ou posterior.

Correção

Memory Corruption

Integer Overflow

Enumeração de Fraquezas

CWE-787

CWE-190

Identificadores relacionados

CVE-2026-34589

ECHO-9812-7C70-A870

GHSA-P8XC-W3Q4-H64X

OESA-2026-1840

OESA-2026-1841

OESA-2026-1842

OESA-2026-1843

OESA-2026-1844

OPENSUSE-SU-2026:10505-1

OPENSUSE-SU-2026:20605-1

Produtos afetados

Openexr

Referências · 48

• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.9 · Nota
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.9 · Nota
• https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.2.7 · Nota
• https://github.com/AcademySoftwareFoundation/openexr/commit/ea588c8f075f5915e34931861e15b6c2d3b62561 · Nota
• https://github.com/AcademySoftwareFoundation/openexr/commit/e464a33cc5bcd9f7dad2364bf76c08a52a5b0fbf · Nota
• https://github.com/AcademySoftwareFoundation/openexr/pull/2328 · Nota
• https://github.com/AcademySoftwareFoundation/openexr/commit/ca0139287918775e1fddc0ed0033d694bec033ff · Nota
• https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-p8xc-w3q4-h64x · Aviso do Fabricante
• https://github.com/AcademySoftwareFoundation/openexr · Nota
• https://suse.com/security/cve/CVE-2026-34379 · Nota
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1841 · Nota
• https://bugzilla.suse.com/1261624 · Nota
• https://ubuntu.com/security/CVE-2026-34589 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34588 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-34589 · Nota de Segurança